CVE-2026-0967: Libssh: libssh: denial of service via inefficient regular expression processing
A flaw was found in libssh. A remote attacker, by controlling client configuration files or knownhosts files, could craft specific hostnames that when processed by the matchpattern() function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.
Other sources
Libssh: libssh: denial of service via inefficient regular expression processing
— Microsoft
The function matchpattern() is used to match conditionals in client configuration files or known hosts against the hostname the client is connecting to.
When the configuration file or knownhosts file is controlled by the attacker, connecting to specific hostnames could cause timeouts and resource exhaustion due to the ineffective backtracking of complex regular expressions.
The pattern matching was modified to avoid the needless backtracing.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0967?
CVE-2026-0967 has a medium severity level due to its potential to cause denial of service.
How do I fix CVE-2026-0967?
To fix CVE-2026-0967, upgrade libssh to the latest version where the vulnerability is patched.
Who is affected by CVE-2026-0967?
CVE-2026-0967 affects users of libssh that utilize client configuration files or known_hosts files.
What type of vulnerability is CVE-2026-0967?
CVE-2026-0967 is a denial of service vulnerability caused by inefficient regular expression processing.
Can CVE-2026-0967 be exploited remotely?
Yes, CVE-2026-0967 can be exploited remotely if an attacker can control specific configurational files.